Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 03:22
Behavioral task
behavioral1
Sample
82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe
Resource
win7-20240215-en
7 signatures
150 seconds
General
-
Target
82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe
-
Size
377KB
-
MD5
bf7409096e1169fd1bdc1e1c141aac88
-
SHA1
9c644656341b6f4a38f1c1a9ee4ed7d04c0fbd42
-
SHA256
82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86
-
SHA512
1fa6aa81ebd11001847210f0d4f940abb0a8ab37fe2024976985eb937292b37d3eaac28dd7390dde12da1c53173b4e75da8f51982de0485bdf3538b1a75650c1
-
SSDEEP
6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7w:/4wFHoSA4KofHfHTXQLzgvnzHPowYbvX
Malware Config
Signatures
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2636-51-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1828-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2252-321-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2516-356-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2988-363-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/320-416-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/3032-431-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1484-461-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/716-484-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2192-500-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1804-531-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2008-523-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1004-515-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2192-507-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2300-499-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1668-492-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1540-476-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1564-468-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2276-454-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2272-439-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1604-424-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2540-408-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2508-399-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1592-391-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2868-377-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2736-342-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2128-329-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2392-313-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2008-304-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1004-294-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1704-276-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/888-268-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1836-258-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1168-230-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2056-221-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1900-212-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2040-202-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2236-192-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1556-183-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2616-164-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1856-154-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2704-137-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2836-119-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2824-110-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1760-100-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2500-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2492-80-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2800-70-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2884-60-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2544-41-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2256-30-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1300-19-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2620-9-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral1/files/0x00340000000149e1-21.dat UPX behavioral1/files/0x0007000000014dae-33.dat UPX behavioral1/files/0x00070000000153c7-62.dat UPX behavioral1/files/0x0006000000015cf5-111.dat UPX behavioral1/files/0x0006000000015d24-129.dat UPX behavioral1/files/0x0006000000015d44-138.dat UPX behavioral1/files/0x0006000000015e09-156.dat UPX behavioral1/files/0x0006000000015fa7-184.dat UPX behavioral1/files/0x00060000000162c9-213.dat UPX behavioral1/files/0x0006000000016476-222.dat UPX behavioral1/files/0x0006000000016813-247.dat UPX behavioral1/files/0x0006000000016c42-285.dat UPX behavioral1/files/0x0033000000014b10-296.dat UPX behavioral1/memory/2988-363-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2844-378-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/320-416-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/3032-431-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2572-440-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1484-461-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2192-500-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2276-454-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2272-439-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1604-424-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2540-408-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2508-392-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1592-391-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2868-377-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2868-370-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2736-342-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2392-305-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0006000000016c8c-303.dat UPX behavioral1/memory/2008-295-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1004-294-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0006000000016c1d-269.dat UPX behavioral1/memory/1836-258-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0006000000016a6f-257.dat UPX behavioral1/memory/1836-248-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x00060000000165f0-240.dat UPX behavioral1/files/0x000600000001654a-231.dat UPX behavioral1/memory/1168-230-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1900-212-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2040-202-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x00060000000161b3-200.dat UPX behavioral1/files/0x00060000000160cc-194.dat UPX behavioral1/memory/2040-193-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2236-192-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1556-183-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0006000000015f3c-174.dat UPX behavioral1/files/0x0006000000015e6d-165.dat UPX behavioral1/memory/2616-155-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1856-154-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2704-137-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0006000000015d24-127.dat UPX behavioral1/files/0x0006000000015d0c-120.dat UPX behavioral1/memory/2836-119-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0006000000015ce3-102.dat UPX behavioral1/memory/2824-101-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/1760-100-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/memory/2500-90-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0006000000015cd9-88.dat UPX behavioral1/memory/2492-80-0x0000000000400000-0x0000000000460000-memory.dmp UPX behavioral1/files/0x0007000000015cce-79.dat UPX behavioral1/files/0x000900000001540d-68.dat UPX behavioral1/memory/2800-70-0x0000000000400000-0x0000000000460000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1300 ttntnt.exe 2256 vpjvd.exe 2544 rlxrlrf.exe 2636 3bnthh.exe 2884 bthnht.exe 2800 djpdv.exe 2492 5xlrfrx.exe 2500 ffxlxrx.exe 1760 1btnht.exe 2824 1hhhnt.exe 2836 pvpvp.exe 2996 xrrfxxf.exe 2704 llflxxl.exe 2416 nnbnbh.exe 1856 vvpdp.exe 2616 vjvvd.exe 2776 rlrfxxl.exe 1556 7xlrxfr.exe 2236 tnbnbb.exe 2040 1pdjd.exe 1900 pjjpd.exe 2056 llfxlxf.exe 1168 nhbnht.exe 1828 dppvp.exe 2408 9ddjp.exe 1836 rrrlffr.exe 888 nthtbn.exe 1704 7vpvd.exe 2192 5bntbh.exe 1004 7tttbn.exe 2008 djppv.exe 2392 flfrlrl.exe 2252 btnntb.exe 2128 jjdjp.exe 2548 lrrflxr.exe 2736 hnhthn.exe 2404 1ttnht.exe 2516 djjvp.exe 2988 xlfxfxl.exe 2848 rllrxfx.exe 2868 btnthn.exe 2844 dddjd.exe 1592 1vdpv.exe 2508 ffxxllx.exe 2540 hbtthn.exe 320 pjdvj.exe 1604 llxfxrr.exe 3032 flfrlrf.exe 2272 hbtbnb.exe 2572 nnhnbn.exe 2276 7jvdp.exe 1484 ffrlllx.exe 1564 hbbnbt.exe 1540 bbbnbh.exe 716 jdjjv.exe 1668 djjvj.exe 2300 fffrxfl.exe 2192 9hhhhh.exe 1004 djdpj.exe 2008 vpvvj.exe 1804 fxllllx.exe 3064 hthntt.exe 2580 hhhtbb.exe 2548 vvpvd.exe -
Molebox Virtualization software 31 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral1/files/0x00340000000149e1-21.dat molebox behavioral1/files/0x0007000000014dae-33.dat molebox behavioral1/files/0x00070000000153c7-62.dat molebox behavioral1/files/0x0006000000015cf5-111.dat molebox behavioral1/files/0x0006000000015d24-129.dat molebox behavioral1/files/0x0006000000015d44-138.dat molebox behavioral1/files/0x0006000000015e09-156.dat molebox behavioral1/files/0x0006000000015fa7-184.dat molebox behavioral1/files/0x00060000000162c9-213.dat molebox behavioral1/files/0x0006000000016476-222.dat molebox behavioral1/files/0x0006000000016813-247.dat molebox behavioral1/files/0x0006000000016c42-285.dat molebox behavioral1/files/0x0033000000014b10-296.dat molebox behavioral1/files/0x0006000000016c8c-303.dat molebox behavioral1/files/0x0006000000016c1d-269.dat molebox behavioral1/files/0x0006000000016a6f-257.dat molebox behavioral1/files/0x00060000000165f0-240.dat molebox behavioral1/files/0x000600000001654a-231.dat molebox behavioral1/files/0x00060000000161b3-200.dat molebox behavioral1/files/0x00060000000160cc-194.dat molebox behavioral1/files/0x0006000000015f3c-174.dat molebox behavioral1/files/0x0006000000015e6d-165.dat molebox behavioral1/files/0x0006000000015d24-127.dat molebox behavioral1/files/0x0006000000015d0c-120.dat molebox behavioral1/files/0x0006000000015ce3-102.dat molebox behavioral1/files/0x0006000000015cd9-88.dat molebox behavioral1/files/0x0007000000015cce-79.dat molebox behavioral1/files/0x000900000001540d-68.dat molebox behavioral1/files/0x000700000001502c-52.dat molebox behavioral1/files/0x0007000000014eb9-42.dat molebox behavioral1/files/0x000b0000000144e0-11.dat molebox -
resource yara_rule behavioral1/memory/2620-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2620-6-0x0000000000460000-0x00000000004C0000-memory.dmp upx behavioral1/files/0x00340000000149e1-21.dat upx behavioral1/files/0x0007000000014dae-33.dat upx behavioral1/memory/2636-51-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x00070000000153c7-62.dat upx behavioral1/memory/2500-81-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0006000000015cf5-111.dat upx behavioral1/files/0x0006000000015d24-129.dat upx behavioral1/files/0x0006000000015d44-138.dat upx behavioral1/files/0x0006000000015e09-156.dat upx behavioral1/files/0x0006000000015fa7-184.dat upx behavioral1/files/0x00060000000162c9-213.dat upx behavioral1/files/0x0006000000016476-222.dat upx behavioral1/memory/1828-239-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0006000000016813-247.dat upx behavioral1/memory/1836-252-0x00000000001B0000-0x0000000000210000-memory.dmp upx behavioral1/files/0x0006000000016c42-285.dat upx behavioral1/files/0x0033000000014b10-296.dat upx behavioral1/memory/2252-314-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2252-321-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2404-343-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2516-356-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2988-363-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2844-378-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2540-403-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/320-416-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/3032-431-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2572-440-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2276-447-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1484-461-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1540-469-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/716-484-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1668-485-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2192-500-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1804-531-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1804-524-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2008-523-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2008-516-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1004-515-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1004-508-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2192-507-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2300-499-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1668-492-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/716-477-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1540-476-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1564-468-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2276-454-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2272-439-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1604-424-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1604-417-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/320-409-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2540-408-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2508-398-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2540-400-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2508-399-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2508-392-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1592-391-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2868-377-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2868-370-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2404-349-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2736-342-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2128-329-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2128-327-0x0000000000400000-0x0000000000460000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 1300 2620 82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe 28 PID 2620 wrote to memory of 1300 2620 82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe 28 PID 2620 wrote to memory of 1300 2620 82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe 28 PID 2620 wrote to memory of 1300 2620 82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe 28 PID 1300 wrote to memory of 2256 1300 ttntnt.exe 29 PID 1300 wrote to memory of 2256 1300 ttntnt.exe 29 PID 1300 wrote to memory of 2256 1300 ttntnt.exe 29 PID 1300 wrote to memory of 2256 1300 ttntnt.exe 29 PID 2256 wrote to memory of 2544 2256 vpjvd.exe 30 PID 2256 wrote to memory of 2544 2256 vpjvd.exe 30 PID 2256 wrote to memory of 2544 2256 vpjvd.exe 30 PID 2256 wrote to memory of 2544 2256 vpjvd.exe 30 PID 2544 wrote to memory of 2636 2544 rlxrlrf.exe 31 PID 2544 wrote to memory of 2636 2544 rlxrlrf.exe 31 PID 2544 wrote to memory of 2636 2544 rlxrlrf.exe 31 PID 2544 wrote to memory of 2636 2544 rlxrlrf.exe 31 PID 2636 wrote to memory of 2884 2636 3bnthh.exe 32 PID 2636 wrote to memory of 2884 2636 3bnthh.exe 32 PID 2636 wrote to memory of 2884 2636 3bnthh.exe 32 PID 2636 wrote to memory of 2884 2636 3bnthh.exe 32 PID 2884 wrote to memory of 2800 2884 bthnht.exe 33 PID 2884 wrote to memory of 2800 2884 bthnht.exe 33 PID 2884 wrote to memory of 2800 2884 bthnht.exe 33 PID 2884 wrote to memory of 2800 2884 bthnht.exe 33 PID 2800 wrote to memory of 2492 2800 djpdv.exe 34 PID 2800 wrote to memory of 2492 2800 djpdv.exe 34 PID 2800 wrote to memory of 2492 2800 djpdv.exe 34 PID 2800 wrote to memory of 2492 2800 djpdv.exe 34 PID 2492 wrote to memory of 2500 2492 5xlrfrx.exe 35 PID 2492 wrote to memory of 2500 2492 5xlrfrx.exe 35 PID 2492 wrote to memory of 2500 2492 5xlrfrx.exe 35 PID 2492 wrote to memory of 2500 2492 5xlrfrx.exe 35 PID 2500 wrote to memory of 1760 2500 ffxlxrx.exe 36 PID 2500 wrote to memory of 1760 2500 ffxlxrx.exe 36 PID 2500 wrote to memory of 1760 2500 ffxlxrx.exe 36 PID 2500 wrote to memory of 1760 2500 ffxlxrx.exe 36 PID 1760 wrote to memory of 2824 1760 1btnht.exe 37 PID 1760 wrote to memory of 2824 1760 1btnht.exe 37 PID 1760 wrote to memory of 2824 1760 1btnht.exe 37 PID 1760 wrote to memory of 2824 1760 1btnht.exe 37 PID 2824 wrote to memory of 2836 2824 1hhhnt.exe 38 PID 2824 wrote to memory of 2836 2824 1hhhnt.exe 38 PID 2824 wrote to memory of 2836 2824 1hhhnt.exe 38 PID 2824 wrote to memory of 2836 2824 1hhhnt.exe 38 PID 2836 wrote to memory of 2996 2836 pvpvp.exe 39 PID 2836 wrote to memory of 2996 2836 pvpvp.exe 39 PID 2836 wrote to memory of 2996 2836 pvpvp.exe 39 PID 2836 wrote to memory of 2996 2836 pvpvp.exe 39 PID 2996 wrote to memory of 2704 2996 xrrfxxf.exe 40 PID 2996 wrote to memory of 2704 2996 xrrfxxf.exe 40 PID 2996 wrote to memory of 2704 2996 xrrfxxf.exe 40 PID 2996 wrote to memory of 2704 2996 xrrfxxf.exe 40 PID 2704 wrote to memory of 2416 2704 llflxxl.exe 41 PID 2704 wrote to memory of 2416 2704 llflxxl.exe 41 PID 2704 wrote to memory of 2416 2704 llflxxl.exe 41 PID 2704 wrote to memory of 2416 2704 llflxxl.exe 41 PID 2416 wrote to memory of 1856 2416 nnbnbh.exe 42 PID 2416 wrote to memory of 1856 2416 nnbnbh.exe 42 PID 2416 wrote to memory of 1856 2416 nnbnbh.exe 42 PID 2416 wrote to memory of 1856 2416 nnbnbh.exe 42 PID 1856 wrote to memory of 2616 1856 vvpdp.exe 43 PID 1856 wrote to memory of 2616 1856 vvpdp.exe 43 PID 1856 wrote to memory of 2616 1856 vvpdp.exe 43 PID 1856 wrote to memory of 2616 1856 vvpdp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe"C:\Users\Admin\AppData\Local\Temp\82d6196037c75b541a772a96687cf2cae930a433d69df95a477e57dd6748fe86.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ttntnt.exec:\ttntnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\vpjvd.exec:\vpjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rlxrlrf.exec:\rlxrlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3bnthh.exec:\3bnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\bthnht.exec:\bthnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\djpdv.exec:\djpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\5xlrfrx.exec:\5xlrfrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ffxlxrx.exec:\ffxlxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\1btnht.exec:\1btnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\1hhhnt.exec:\1hhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pvpvp.exec:\pvpvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xrrfxxf.exec:\xrrfxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\llflxxl.exec:\llflxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nnbnbh.exec:\nnbnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vvpdp.exec:\vvpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\vjvvd.exec:\vjvvd.exe17⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rlrfxxl.exec:\rlrfxxl.exe18⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7xlrxfr.exec:\7xlrxfr.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tnbnbb.exec:\tnbnbb.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1pdjd.exec:\1pdjd.exe21⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pjjpd.exec:\pjjpd.exe22⤵
- Executes dropped EXE
PID:1900 -
\??\c:\llfxlxf.exec:\llfxlxf.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nhbnht.exec:\nhbnht.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\dppvp.exec:\dppvp.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\9ddjp.exec:\9ddjp.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rrrlffr.exec:\rrrlffr.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nthtbn.exec:\nthtbn.exe28⤵
- Executes dropped EXE
PID:888 -
\??\c:\7vpvd.exec:\7vpvd.exe29⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5bntbh.exec:\5bntbh.exe30⤵
- Executes dropped EXE
PID:2192 -
\??\c:\7tttbn.exec:\7tttbn.exe31⤵
- Executes dropped EXE
PID:1004 -
\??\c:\djppv.exec:\djppv.exe32⤵
- Executes dropped EXE
PID:2008 -
\??\c:\flfrlrl.exec:\flfrlrl.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\btnntb.exec:\btnntb.exe34⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jjdjp.exec:\jjdjp.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lrrflxr.exec:\lrrflxr.exe36⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hnhthn.exec:\hnhthn.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1ttnht.exec:\1ttnht.exe38⤵
- Executes dropped EXE
PID:2404 -
\??\c:\djjvp.exec:\djjvp.exe39⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xlfxfxl.exec:\xlfxfxl.exe40⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rllrxfx.exec:\rllrxfx.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\btnthn.exec:\btnthn.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dddjd.exec:\dddjd.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1vdpv.exec:\1vdpv.exe44⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ffxxllx.exec:\ffxxllx.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbtthn.exec:\hbtthn.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pjdvj.exec:\pjdvj.exe47⤵
- Executes dropped EXE
PID:320 -
\??\c:\llxfxrr.exec:\llxfxrr.exe48⤵
- Executes dropped EXE
PID:1604 -
\??\c:\flfrlrf.exec:\flfrlrf.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hbtbnb.exec:\hbtbnb.exe50⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nnhnbn.exec:\nnhnbn.exe51⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7jvdp.exec:\7jvdp.exe52⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ffrlllx.exec:\ffrlllx.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hbbnbt.exec:\hbbnbt.exe54⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bbbnbh.exec:\bbbnbh.exe55⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jdjjv.exec:\jdjjv.exe56⤵
- Executes dropped EXE
PID:716 -
\??\c:\djjvj.exec:\djjvj.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fffrxfl.exec:\fffrxfl.exe58⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9hhhhh.exec:\9hhhhh.exe59⤵
- Executes dropped EXE
PID:2192 -
\??\c:\djdpj.exec:\djdpj.exe60⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vpvvj.exec:\vpvvj.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fxllllx.exec:\fxllllx.exe62⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hthntt.exec:\hthntt.exe63⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hhhtbb.exec:\hhhtbb.exe64⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vvpvd.exec:\vvpvd.exe65⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jdvdv.exec:\jdvdv.exe66⤵PID:2552
-
\??\c:\frrxllr.exec:\frrxllr.exe67⤵PID:2976
-
\??\c:\nnbhnt.exec:\nnbhnt.exe68⤵PID:1268
-
\??\c:\tnbhnn.exec:\tnbhnn.exe69⤵PID:2812
-
\??\c:\dpdvv.exec:\dpdvv.exe70⤵PID:2956
-
\??\c:\jdvvv.exec:\jdvvv.exe71⤵PID:2972
-
\??\c:\xlxffxf.exec:\xlxffxf.exe72⤵PID:2496
-
\??\c:\7btntt.exec:\7btntt.exe73⤵PID:1592
-
\??\c:\nhtbnt.exec:\nhtbnt.exe74⤵PID:1904
-
\??\c:\pddjj.exec:\pddjj.exe75⤵PID:1192
-
\??\c:\3rrrrll.exec:\3rrrrll.exe76⤵PID:1604
-
\??\c:\rrlfrrx.exec:\rrlfrrx.exe77⤵PID:2088
-
\??\c:\3bthnb.exec:\3bthnb.exe78⤵PID:804
-
\??\c:\9nhnbh.exec:\9nhnbh.exe79⤵PID:584
-
\??\c:\9vjjj.exec:\9vjjj.exe80⤵PID:3020
-
\??\c:\5ddjd.exec:\5ddjd.exe81⤵PID:2316
-
\??\c:\rffxlxl.exec:\rffxlxl.exe82⤵PID:2524
-
\??\c:\3nnntb.exec:\3nnntb.exe83⤵PID:600
-
\??\c:\9tnhtt.exec:\9tnhtt.exe84⤵PID:1668
-
\??\c:\pjvdj.exec:\pjvdj.exe85⤵PID:1704
-
\??\c:\vdvpv.exec:\vdvpv.exe86⤵PID:2196
-
\??\c:\fxrxlxx.exec:\fxrxlxx.exe87⤵PID:1004
-
\??\c:\fxlrllr.exec:\fxlrllr.exe88⤵PID:1300
-
\??\c:\hhbhtt.exec:\hhbhtt.exe89⤵PID:2564
-
\??\c:\7tnnnh.exec:\7tnnnh.exe90⤵PID:2464
-
\??\c:\7pdjp.exec:\7pdjp.exe91⤵PID:1864
-
\??\c:\fxxlxlr.exec:\fxxlxlr.exe92⤵PID:2472
-
\??\c:\tthhbh.exec:\tthhbh.exe93⤵PID:2800
-
\??\c:\nntbbb.exec:\nntbbb.exe94⤵PID:2512
-
\??\c:\jdvvd.exec:\jdvvd.exe95⤵PID:3068
-
\??\c:\jvddj.exec:\jvddj.exe96⤵PID:2628
-
\??\c:\jdvdj.exec:\jdvdj.exe97⤵PID:2968
-
\??\c:\5rxlrll.exec:\5rxlrll.exe98⤵PID:2856
-
\??\c:\bthbhh.exec:\bthbhh.exe99⤵PID:2868
-
\??\c:\7ntttn.exec:\7ntttn.exe100⤵PID:2160
-
\??\c:\bbnnth.exec:\bbnnth.exe101⤵PID:1672
-
\??\c:\vpdpp.exec:\vpdpp.exe102⤵PID:1528
-
\??\c:\fxllrll.exec:\fxllrll.exe103⤵PID:1444
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe104⤵PID:1808
-
\??\c:\3bhnnt.exec:\3bhnnt.exe105⤵PID:2104
-
\??\c:\hbhhhb.exec:\hbhhhb.exe106⤵PID:2612
-
\??\c:\dvjvd.exec:\dvjvd.exe107⤵PID:324
-
\??\c:\5ddvv.exec:\5ddvv.exe108⤵PID:1724
-
\??\c:\1xllrll.exec:\1xllrll.exe109⤵PID:1824
-
\??\c:\7fllrrx.exec:\7fllrrx.exe110⤵PID:2412
-
\??\c:\hthnnn.exec:\hthnnn.exe111⤵PID:1400
-
\??\c:\nbnhnt.exec:\nbnhnt.exe112⤵PID:1052
-
\??\c:\jjppv.exec:\jjppv.exe113⤵PID:2408
-
\??\c:\dpdjj.exec:\dpdjj.exe114⤵PID:2740
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe115⤵PID:2084
-
\??\c:\1fxflfl.exec:\1fxflfl.exe116⤵PID:2396
-
\??\c:\nbnnnn.exec:\nbnnnn.exe117⤵PID:1792
-
\??\c:\hnhtbh.exec:\hnhtbh.exe118⤵PID:1704
-
\??\c:\dpddd.exec:\dpddd.exe119⤵PID:2200
-
\??\c:\dpddd.exec:\dpddd.exe120⤵PID:2120
-
\??\c:\rlffrrl.exec:\rlffrrl.exe121⤵PID:2256
-
\??\c:\xlxlxxl.exec:\xlxlxxl.exe122⤵PID:2568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-